Target says anyone who made purchases by swiping cards at terminals in its U.S. stores between Nov. 27 and Dec. 15 might have had their accounts exposed. The stolen data included customer names, credit and debit card numbers, card expiration dates and the embedded code on the magnetic strip on back of the card, Target said.
There was no indication that the three- or four-digit security numbers visible on the back of the card were affected.
The stolen information included Target store brand cards and major card brands such as Visa and MasterCard.
The data breach did not affect online purchases, the company said.
Here are some answers to the most common questions about the theft:
Q: I shopped at Target during that time. What should I do?
A: Check your credit card statements carefully. If you see suspicious charges, report the activity to your credit card companies and call Target at (866) 852-8680. You can report cases of identity theft to law enforcement or the Federal Trade Commission.
You can get more information about identity theft on the FTC’s Web site at www.consumer.gov/idtheft, or by calling the FTC, at (877) IDTHEFT (438-4338).
Q: How did the breach occur?
A: Target isn’t saying how it happened. Industry experts note that companies such as Target spend millions of dollars each year on credit card security, making a theft of this magnitude particularly alarming.
Experts disagree about how the breach might have happened.
Avivah Litan, a security analyst with Gartner Research, says given all the security, she believes the breach might have been an inside job.
But thefts of this size are too big to be the work of company employees, says Ken Stasiak, the founder and CEO of Secure State, a Cleveland-based information security firm that investigates data breaches. Stasiak says that such breaches are generally perpetrated by organized crime or an overseas, state-sponsored hacker group.
Stasiak’s theory is that the hackers were able to breach Target’s main information hub and then wrote a code that gave them access to the company’s point of sale system and all of its cash registers.
James Lyne, the global head of security research for the computer security firm Sophos, says something clearly went wrong with Target’s security measures.
“Forty million cards stolen really shows a substantial security failure,” he says. “This shouldn’t have happened.”
Q: Who pays if there are fraudulent charges on my account?
A: The good news is in most cases consumers aren’t on the hook for fraudulent charges.
Credit card companies are often able to flag the charges before they go through and shutdown your card. If that doesn’t happen, the card issuer will generally strip charges you claim are fraudulent off your card immediately.
And because the fraud has been tied to Target, it’ll be the retailer that ultimately compensates the banks and credit card companies.
Q: How can future breaches be prevented?
A: Litan says an easy way to prevent fraud would be to eliminate the use of easily cloned magnetic strip cards and upgrade to the kind of microchip technology used in most other parts of the world.
But she says banks have pushed back against the idea, because the microchip cards cost significantly more than the magnetic strip version and changing over all the country’s ATMs could drive the total costs into the billions of dollars.
Lyne says it’s unclear if the use of microchip cards would have prevented the Target breach, because it’s unclear how it happened, but that it certainly wouldn’t hurt.
Q: Why is the Secret Service investigating?
A: While it’s most famous for protecting the president, the Secret Service also is responsible for protecting the nation’s financial infrastructure and payment systems. As a result, it has broad jurisdiction over a wide variety of financial crimes. It isn’t uncommon for the agency to investigate major thefts involving credit card information.